9 ms·
We had to do this for a link shortening system (to make sure random base64 didn't contain profanity). It was a pretty fun problem. Not just the implementation,
by phamilton 5y ago
We had to do this for a link shortening system (to make sure random base64 didn't contain profanity). It was a pretty fun problem. Not just the implementation, but doing the math to make sure it didn't make our shortened links easily enumerable. The implementation wasn't too bad, but we set up logging initially to spit out any random strings it decided to block. I demo'd this in front of the whole company and live tailed the logs and the first one that popped up during the demo was a big ole F bomb. It made for an excellent demo.
- smohare 5y agoIt’s so laughable that we care about whether a generated string contains some temporally relevant profanity. We truly are still barbarians, and will be viewed as such by history.
- tsimionescu 5y agoWell, given that we have a more than 5000 years old habit of looking for omens in random data to divine the future (whether that random data is scattered bones, laid out animal entrails, tea leaves, coffee grounds, tarot cards or so many others), it's unfortunate but not surprising.
- gregoriol 5y agoIt highly depends on what the purpose of the string is: if it can be clearly seen by the user, has to be read, or worse typed, then it's not just a random string in a database. If the string is a url, imagine sending https://somesite/wanker https://somesite/wanker to your client, when it actually could also be https://somesite/ay3ugd https://somesite/ay3ugd
- Biganon 5y agoIt's not that stupid. People will send the shortened link to other people, who might not understand that the string was randomly generated.
- pixl97 5y ago"Hello Richard, your access key is URAC0CK" It's random, I swear!
- Veen 5y agoIf you generate an identifier for an important client that contains "knobhead," they won't think it's a randomly generated string, but that someone at your company is deliberately insulting them.
- beachy 5y ago> to make sure random base64 didn't contain profanity I would have said "why bother" until this happened to us. A customer rang us up in a fury because some demo/ random data that we generated happened to have the word "penis" in it. They were convinced we must have put it there because we thought he was a cock. It was very difficult to defuse the situation.
- unknownOrigin 5y ago> I would have said "why bother" until this happened to us. Aah, the good ole "one customer is unhappy, let's waste a week of time on this" approach to IT management. Takes guts to tell such customers "here's your refund, now piss off", but it is the right thing to do.
- solarkraft 5y agoNot just that, also “let’s all stop having fun”. (Not about this case, but
- shpx 5y agoRecently on HN someone thought that reddit.com/imgur directing to a post on /r/Drugs meant something when it's just a randomly generated ID. All 5 letter word that I tried worked because there's been so many posts. https://news.ycombinator.com/item?id=28676096 https://news.ycombinator.com/item?id=28676096
- resonious 5y agoI just recently saw a randomly generated ID of ours in production that starts with "doggy". Thankfully "doggy" is pretty innocent, but it really made me think "wow what if it was something bad". Unfortunate that that exact scenario seems to have happened to you already.
- eps 5y agoI have a bus ticket from Stockholm with the serial of F4CK. Totally made my day back then to be honest.
- Waterluvian 5y agoFascinating! I guess an easy solution is to inject non alpha characters into any generated string. I imagine a constraint was that you wanted them to be easy to type?
- phamilton 5y agoSMS is the biggest constraint. Unicode characters trigger lower segment char limits (effectively doubling the cost of a 71 char text message). And also it's important that the links can be clicked on a smartphone. So url-safe base64 (some shorteners use base62). And numbers can be N4u6hty too, so you gotta catch those cases.
- Waterluvian 5y agoGoodness the scope of the problem just exploded in my mind after this explanation.
- phamilton 5y agoThe good news is that things like https://github.com/LDNOOBW/List-of-Dirty-Naughty-Obscene-and-Otherwise-Bad-Words https://github.com/LDNOOBW/List-of-Dirty-Naughty-Obscene-and... exist so getting a source of words to filter is easy enough. And converting numbers to letters isn't too bad. The hardest problem with the implementation was that with a long list you can't just search for a few dozen inappropriate words (like the Twitch implementation). It would be very expensive to do hundreds or even thousands of checks against every inappropriate word. The solution we came to was to truncate all the inappropriate words to either 3 or 4 letters and store them in a big set. We then take our generated strings, which are usually 11 characters, and break them up into all possible substrings of lengths 3 and 4. For example, 1a2b3c4d5e6 would be broken down into 1a2 a2b 2b3 b3c 3c4 c4d 4d5 5e6 1a2b a2b3 2b3c b3c4 3c4d c4d5 4d5e d5e6. An 11 character string would always have 16 such substrings. We then check all 16 against the banned set. 16 lookups into a set is pretty cheap and as we have expanded the word set over time (e.g. add a new language) our performance hasn't changed. One drawback to our approach is that we do have false positives but we did the math and our space was still large enough, the cost of generating a new one was pretty low, and customers never see it so it's just not a big deal to throw out false positives.
- pchristensen 5y agoWe did a similar thing at Groupon after a customer’s coupon code contained an F bomb.
- EvanAnderson 5y agoI removed the letter U from a random password generator for a Customer's app after a password was generated containing the "C-word".
- AstralStorm 5y agoI presume you removed V as well? :)
- ithinkso 5y agoBoth of you are allowed to swear on the internet
- timthorn 5y agoThey're allowed, but it is courteous of them to refrain.
- rsynnott 5y agoAnd yet, not _required_ to if they don't want to.
- ithinkso 5y agoI agree, I only wanted to point out that they can I they want to. I didn't say they have to Edit: I'm being downvoted so I want to explain - the internet is a huge mishmash of different cultures and all I wanted to say is that it is allowed to swear because I though that maybe, in their local one, it is not and they think it's universal
- 0des 5y agoLet it go, downvotes don't matter.
- geoduck14 5y ago>the first one that popped up during the demo was a big ole F bomb And this, ladies and gentlemen, is what it would show BEFORE the filter... but after (runs the code again, and prays it works) ... NO PROFANITY!
- phamilton 5y agoTo be clear, this was the list of "things we blocked". "Had we not done this work, that link would have been sent out to one of our users." was very well received.
- ademarre 5y agoWhen it comes to censoring randomly generated strings, I like simply to omit vowels from the alphabet. Usually I'll omit some of the more obvious lookalikes too, e.g. [1 0 v]. It's a simple solution. Sure, it is still possible for something to slip through that looks similar to something bad. But the potential to strongly offend is greatly reduced.
- cratermoon 5y agoYeah there was an article I read a while back about a company looking to prevent the use of 'naughty' words in randomly-generated strings used as event IDs. Apparently someone with some pull had seen a message with an offensive word. Some management committee spent a long time trying to figure out how to solve the problem including proposing keeping a list of bad words, and then worrying about what should be in it and who would maintain it. At some point an engineer got a chance to speak and said something like "just use base-31 and omit vowels". The story as I remember it didn't mention the use of v or l33t-speak, but they were randomly generated, not maliciously constructed, values. Also note that if you're too naive about checking for 'naughty' words, you get https://en.wikipedia.org/wiki/Scunthorpe_problem https://en.wikipedia.org/wiki/Scunthorpe_problem
- executesorder66 5y ago> didn't mention the use of v or l33t-speak What is 'v' in this context? Edit: thanks for the answers. It makes sense now.
- omegalulw 5y agoHow statistically likely is this? Can't you just regenerate until no you have a suitable short URL. Aside from performance, this is as random as you can be. Or generate the characters one by one and backtrack, this requires less random days. Or regenerate the unwanted substring.
- phamilton 5y agoJust trying again is absolutely fine. Our main concern was whether we needed to increase the size to 26 to account for the loss of keys. After doing the math, a 25 digit random string has a ~5% chance of containing one of 150 three or four character inappropriate substrings. That 5% loss isn't that big of a deal. But we had to figure out the math as part of due diligence before shipping.
- mcintyre1994 5y agoHashids (https://hashids.org/#how-does-it-work https://hashids.org/#how-does-it-work) have a pretty clever trick for this. They’re able to encode multiple IDs to a single obfuscated hash, which works by reserving some characters from the alphabet to use as a separator between each encoded value. That guarantees that whatever characters you choose to be separators are never next to each other in the output. By default their separators are (lower + upper case) “c, s, f, h, u, i, t” It worked surprisingly well when we used it.
- delsarto 5y agoIn my help desk days I took a call from an irate person ranting about how we were telling her to "get a male sex change". Eventually I figured out she had become upset with "msexchange" showing up in the address!
- CRConrad 5y agoBefore Stack Overflow there was Experts Exchange. Their URL was of course those two words, all lowercase and mashed together into one... (Can't recall if they later inserted an underscore in between them?)
- Handytinge 5y agoThey added a tac eventually, I guess after their trip to pen island. It was expertsexchange.com for a long time though.